Standards in Use

EMV June 16Caribbean Electronic Payments LLC2

EMV specification hierarchy with the payment industry AEIPSMCHIPVIS UKIS MPE JCCA INDUSTRY ASSOCIATIONS NATIONAL (examples) Payment specifications review

EMV Level One EMV Level One EMV Level Two Electro - mechanical Electro - mechanical Credit / Debit / Charge transaction processing Payment specifications review - card  There are two distinct levels of EMV  Generally transparent to the card

Does not cover: Card internal functions Terminal - acquirer, on-us ATM comms Scheme interfaces National / domestic schemes or infrastructure  Ensure card and terminal compatibility  Covers: – Contact cards – Credit and debit applications – Application selection EMV Specifications – Card

Global Platform, Multos, Proprietary These are the operating systems on the chip provided by: Visa – Global Platform MasterCard – Multos(MChip4) Gemalto, Oberthur – Proprietary Often licenced to other organisations More of these are appearing to service the emerging markets in Africa etc.

PCI DSS What is it Payment Card Industry Data Security Standard

PCI DSS What does it do Protects cardholder data at the: Terminal Merchant Acquirer Network Issuer

PCI Data Security What Mandated since June 2001, Visa’s CISP is intended to protect Visa cardholder data—wherever it resides. Now covers all card schemes, retailers, processors etc. Who All members must comply and ensure the compliance of their merchants and service providers who store, process, or transmit account numbers. The program applies to all payment channels, including card present, mail/telephone order, and e-commerce.

PCI Data Security How To achieve CISP compliance, all members, merchants and service providers must adhere to the Payment Card Industry (PCI) Data Security Standard, which offers a single approach to safeguarding sensitive data for all card brands. Why By complying with the PCI Data Security Standard, scheme members, merchants, and service providers not only meet their obligations to the payment system, but also build a culture of security that benefits all parties.

PCI Data Security PCI Data Security Standard Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect data 2. Do not use vendor-supplied defaults for system passwords and other security parameters

PCI Data Security Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data and sensitive information across open public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software 6. Develop and maintain secure systems and applications

PCI Data Security Implement Strong Access Control Measures 7. Restrict access to data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security

PCI Merchants Merchant Level Description 1Any merchant, regardless of acceptance channel, processing over 6,000,000 transactions per year. Any merchant that has suffered a breach that resulted in an account data compromise. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system. Any merchant identified by any other payment card brand as Level 1. 2Any merchant processing 1,000,000 to 6,000,000 transactions per year. 3Any merchant processing 20,000 to 1,000,000 Visa e-commerce transactions per year. 4Any merchant processing less than 20,000 Visa e-commerce transactions per year, and all other merchants processing up to 1,000,000 Visa transactions per year.

PCI Providers Service Provider Level Description 1All VisaNet® processors (member and non member) and all payment gateways. 2Any service provider that is not in Level 1 and stores, processes, or transmits more than 1,000,000 Visa accounts/transactions annually. 3Any service provider that is not in Level 1 and stores, processes, or transmits less than 1,000,000 Visa accounts/transactions annually.

Requirements All Merchants and Processors must comply to PCI Data Security. Level One Merchants and Level One and Two processors are required to undergo and annual audit. All other levels must provide an annual self assessment form All levels must undertake a network scan quarterly.